Add CORS support to the actuator’s endpoints

This commit adds CORS support to the Actuator’s MVC endpoints. CORS
support is disabled by default and is only enabled once the
endpoints.cors.allowed-origins property has been set.

The new properties to control the endpoints’ CORS configuration are:

endpoints.cors.allow-credentials
endpoints.cors.allowed-origins
endpoints.cors.allowed-methods
endpoints.cors.allowed-headers
endpoints.cors.exposed-headers

The changes to enable Jolokia-specific CORS support (57a51ed) have been
reverted as part of this commit. This provides a consistent approach
to CORS configuration across all endpoints, rather than Jolokia using
its own configuration.

See gh-1987
Closes gh-2936

spring-boot-docs/src/main/asciidoc/appendix-application-properties.adoc

@@ -551,6 +551,13 @@ content into your application; rather pick only the properties that you need.
 	endpoints.trace.sensitive=true
 	endpoints.trace.enabled=true
 
+	# ENDPOINTS CORS CONFIGURATION ({sc-spring-boot-actuator}/autoconfigure/MvcEndpointCorsProperties.{sc-ext}[MvcEndpointCorsProperties])
+	endpoints.cors.allow-credentials= # whether user credentials are support. When not set, credentials are not supported.
+	endpoints.cors.allowed-origins= # comma-separated list of origins to allow. * allows all origins. When not set, CORS support is disabled.
+	endpoints.cors.allowed-methods= # comma-separated list of methods to allow. * allows all methods. When not set, defaults to GET.
+	endpoints.cors.allowed-headers= # comma-separated list of headers to allow in a request. * allows all headers.
+	endpoints.cors.exposed-headers= # comma-separated list of headers to include in a response.
+
 	# HEALTH INDICATORS (previously health.*)
 	management.health.db.enabled=true
 	management.health.elasticsearch.enabled=true